openclaw/appcast.xml at main · laminko/openclaw

Repository navigation

History

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

<?xml version="1.0" standalone="yes"?>

<title>OpenClaw</title>

<item>

<sparkle:version>8900</sparkle:version>

<sparkle:shortVersionString>2026.2.4</sparkle:shortVersionString>

<sparkle:minimumSystemVersion>15.0</sparkle:minimumSystemVersion>

<description><![CDATA[<h2>OpenClaw 2026.2.4</h2>

<h3>Changes</h3>

<ul>

<li>Telegram: remove last <code>@ts-nocheck</code> from <code>bot-handlers.ts</code>, use Grammy types directly, deduplicate <code>StickerMetadata</code>. Zero <code>@ts-nocheck</code> remaining in <code>src/telegram/</code>. (#9206)</li>

<li>Telegram: remove <code>@ts-nocheck</code> from <code>bot-message.ts</code>, type deps via <code>Omit<BuildTelegramMessageContextParams></code>, widen <code>allMedia</code> to <code>TelegramMediaRef[]</code>. (#9180)</li>

<li>Telegram: remove <code>@ts-nocheck</code> from <code>bot.ts</code>, fix duplicate <code>bot.catch</code> error handler (Grammy overrides), remove dead reaction <code>message_thread_id</code> routing, harden sticker cache guard. (#9077)</li>

<li>Onboarding: add Cloudflare AI Gateway provider setup and docs. (#7914) Thanks @roerohan.</li>

<li>Onboarding: add Moonshot (.cn) auth choice and keep the China base URL when preserving defaults. (#7180) Thanks @waynelwz.</li>

<li>Docs: clarify tmux send-keys for TUI by splitting text and Enter. (#7737) Thanks @Wangnov.</li>

<li>Docs: mirror the landing page revamp for zh-CN (features, quickstart, docs directory, network model, credits). (#8994) Thanks @joshp123.</li>

<li>Messages: add per-channel and per-account responsePrefix overrides across channels. (#9001) Thanks @mudrii.</li>

<li>Cron: add announce delivery mode for isolated jobs (CLI + Control UI) and delivery mode config.</li>

<li>Cron: default isolated jobs to announce delivery; accept ISO 8601 <code>schedule.at</code> in tool inputs.</li>

<li>Cron: hard-migrate isolated jobs to announce/none delivery; drop legacy post-to-main/payload delivery fields and <code>atMs</code> inputs.</li>

<li>Cron: delete one-shot jobs after success by default; add <code>--keep-after-run</code> for CLI.</li>

<li>Cron: suppress messaging tools during announce delivery so summaries post consistently.</li>

<li>Cron: avoid duplicate deliveries when isolated runs send messages directly.</li>

</ul>

<h3>Fixes</h3>

<ul>

<li>Heartbeat: allow explicit accountId routing for multi-account channels. (#8702) Thanks @lsh411.</li>

<li>TUI/Gateway: handle non-streaming finals, refresh history for non-local chat runs, and avoid event gap warnings for targeted tool streams. (#8432) Thanks @gumadeiras.</li>

<li>Shell completion: auto-detect and migrate slow dynamic patterns to cached files for faster terminal startup; add completion health checks to doctor/update/onboard.</li>

<li>Telegram: honor session model overrides in inline model selection. (#8193) Thanks @gildo.</li>

<li>Web UI: fix agent model selection saves for default/non-default agents and wrap long workspace paths. Thanks @Takhoffman.</li>

<li>Web UI: resolve header logo path when <code>gateway.controlUi.basePath</code> is set. (#7178) Thanks @Yeom-JinHo.</li>

<li>Web UI: apply button styling to the new-messages indicator.</li>

<li>Security: keep untrusted channel metadata out of system prompts (Slack/Discord). Thanks @KonstantinMirin.</li>

<li>Security: enforce sandboxed media paths for message tool attachments. (#9182) Thanks @victormier.</li>

<li>Security: require explicit credentials for gateway URL overrides to prevent credential leakage. (#8113) Thanks @victormier.</li>

<li>Security: gate <code>whatsapp_login</code> tool to owner senders and default-deny non-owner contexts. (#8768) Thanks @victormier.</li>

<li>Voice call: harden webhook verification with host allowlists/proxy trust and keep ngrok loopback bypass.</li>

<li>Voice call: add regression coverage for anonymous inbound caller IDs with allowlist policy. (#8104) Thanks @victormier.</li>

<li>Cron: accept epoch timestamps and 0ms durations in CLI <code>--at</code> parsing.</li>

<li>Cron: reload store data when the store file is recreated or mtime changes.</li>

<li>Cron: deliver announce runs directly, honor delivery mode, and respect wakeMode for summaries. (#8540) Thanks @tyler6204.</li>

<li>Telegram: include forward_from_chat metadata in forwarded messages and harden cron delivery target checks. (#8392) Thanks @Glucksberg.</li>

<li>macOS: fix cron payload summary rendering and ISO 8601 formatter concurrency safety.</li>

</ul>

<p><a href="https://github.com/openclaw/openclaw/blob/main/CHANGELOG.md">View full changelog</a></p>

]]></description>

</item>

<item>

<sparkle:version>8809</sparkle:version>

<sparkle:shortVersionString>2026.2.2</sparkle:shortVersionString>

<sparkle:minimumSystemVersion>15.0</sparkle:minimumSystemVersion>

<description><![CDATA[<h2>OpenClaw 2026.2.2</h2>

<h3>Changes</h3>

<ul>

<li>Feishu: add Feishu/Lark plugin support + docs. (#7313) Thanks @jiulingyun (openclaw-cn).</li>

<li>Web UI: add Agents dashboard for managing agent files, tools, skills, models, channels, and cron jobs.</li>

<li>Memory: implement the opt-in QMD backend for workspace memory. (#3160) Thanks @vignesh07.</li>

<li>Security: add healthcheck skill and bootstrap audit guidance. (#7641) Thanks @Takhoffman.</li>

<li>Config: allow setting a default subagent thinking level via <code>agents.defaults.subagents.thinking</code> (and per-agent <code>agents.list[].subagents.thinking</code>). (#7372) Thanks @tyler6204.</li>

<li>Docs: zh-CN translations seed + polish, pipeline guidance, nav/landing updates, and typo fixes. (#8202, #6995, #6619, #7242, #7303, #7415) Thanks @AaronWander, @taiyi747, @Explorer1092, @rendaoyuan, @joshp123, @lailoo.</li>

</ul>

<h3>Fixes</h3>

<ul>

<li>Security: require operator.approvals for gateway /approve commands. (#1) Thanks @mitsuhiko, @yueyueL.</li>

<li>Security: Matrix allowlists now require full MXIDs; ambiguous name resolution no longer grants access. Thanks @MegaManSec.</li>

<li>Security: enforce access-group gating for Slack slash commands when channel type lookup fails.</li>

<li>Security: require validated shared-secret auth before skipping device identity on gateway connect.</li>

<li>Security: guard skill installer downloads with SSRF checks (block private/localhost URLs).</li>

<li>Security: harden Windows exec allowlist; block cmd.exe bypass via single &. Thanks @simecek.</li>

<li>fix(voice-call): harden inbound allowlist; reject anonymous callers; require Telnyx publicKey for allowlist; token-gate Twilio media streams; cap webhook body size (thanks @simecek)</li>

<li>Media understanding: apply SSRF guardrails to provider fetches; allow private baseUrl overrides explicitly.</li>

<li>fix(webchat): respect user scroll position during streaming and refresh (#7226) (thanks @marcomarandiz)</li>

<li>Telegram: recover from grammY long-poll timed out errors. (#7466) Thanks @macmimi23.</li>

<li>Agents: repair malformed tool calls and session transcripts. (#7473) Thanks @justinhuangcode.</li>

<li>fix(agents): validate AbortSignal instances before calling AbortSignal.any() (#7277) (thanks @Elarwei001)</li>

<li>Media understanding: skip binary media from file text extraction. (#7475) Thanks @AlexZhangji.</li>

<li>Onboarding: keep TUI flow exclusive (skip completion prompt + background Web UI seed); completion prompt now handled by install/update.</li>

<li>TUI: block onboarding output while TUI is active and restore terminal state on exit.</li>

<li>CLI/Zsh completion: cache scripts in state dir and escape option descriptions to avoid invalid option errors.</li>

<li>fix(ui): resolve Control UI asset path correctly.</li>

<li>fix(ui): refresh agent files after external edits.</li>

<li>Docs: finish renaming the QMD memory docs to reference the OpenClaw state dir.</li>

<li>Tests: stub SSRF DNS pinning in web auto-reply + Gemini video coverage. (#6619) Thanks @joshp123.</li>

</ul>

<p><a href="https://github.com/openclaw/openclaw/blob/main/CHANGELOG.md">View full changelog</a></p>

]]></description>

</item>

<item>

<sparkle:version>8650</sparkle:version>

<sparkle:shortVersionString>2026.2.1</sparkle:shortVersionString>

<sparkle:minimumSystemVersion>15.0</sparkle:minimumSystemVersion>

<description><![CDATA[<h2>OpenClaw 2026.2.1</h2>

<h3>Changes</h3>

<ul>

<li>Docs: onboarding/install/i18n/exec-approvals/Control UI/exe.dev/cacheRetention updates + misc nav/typos. (#3050, #3461, #4064, #4675, #4729, #4763, #5003, #5402, #5446, #5474, #5663, #5689, #5694, #5967, #6270, #6300, #6311, #6416, #6487, #6550, #6789)</li>

<li>Telegram: use shared pairing store. (#6127) Thanks @obviyus.</li>

<li>Agents: add OpenRouter app attribution headers. Thanks @alexanderatallah.</li>

<li>Agents: add system prompt safety guardrails. (#5445) Thanks @joshp123.</li>

<li>Agents: update pi-ai to 0.50.9 and rename cacheControlTtl -> cacheRetention (with back-compat mapping).</li>

<li>Agents: extend CreateAgentSessionOptions with systemPrompt/skills/contextFiles.</li>

<li>Agents: add tool policy conformance snapshot (no runtime behavior change). (#6011)</li>

<li>Auth: update MiniMax OAuth hint + portal auth note copy.</li>

<li>Discord: inherit thread parent bindings for routing. (#3892) Thanks @aerolalit.</li>

<li>Gateway: inject timestamps into agent and chat.send messages. (#3705) Thanks @conroywhitney, @CashWilliams.</li>

<li>Gateway: require TLS 1.3 minimum for TLS listeners. (#5970) Thanks @loganaden.</li>

<li>Web UI: refine chat layout + extend session active duration.</li>

<li>CI: add formal conformance + alias consistency checks. (#5723, #5807)</li>

</ul>

<h3>Fixes</h3>

<ul>

<li>Plugins: validate plugin/hook install paths and reject traversal-like names.</li>

<li>Telegram: add download timeouts for file fetches. (#6914) Thanks @hclsys.</li>

<li>Telegram: enforce thread specs for DM vs forum sends. (#6833) Thanks @obviyus.</li>

<li>Streaming: flush block streaming on paragraph bou 5E25 ndaries for newline chunking. (#7014)</li>

<li>Streaming: stabilize partial streaming filters.</li>

<li>Auto-reply: avoid referencing workspace files in /new greeting prompt. (#5706) Thanks @bravostation.</li>

<li>Tools: align tool execute adapters/signatures (legacy + parameter order + arg normalization).</li>

<li>Tools: treat <code>"*"</code> tool allowlist entries as valid to avoid spurious unknown-entry warnings.</li>

<li>Skills: update session-logs paths from .clawdbot to .openclaw. (#4502)</li>

<li>Slack: harden media fetch limits and Slack file URL validation. (#6639) Thanks @davidiach.</li>

<li>Lint: satisfy curly rule after import sorting. (#6310)</li>

<li>Process: resolve Windows <code>spawn()</code> failures for npm-family CLIs by appending <code>.cmd</code> when needed. (#5815) Thanks @thejhinvirtuoso.</li>

<li>Discord: resolve PluralKit proxied senders for allowlists and labels. (#5838) Thanks @thewilloftheshadow.</li>

<li>Tlon: add timeout to SSE client fetch calls (CWE-400). (#5926)</li>

<li>Memory search: L2-normalize local embedding vectors to fix semantic search. (#5332)</li>

<li>Agents: align embedded runner + typings with pi-coding-agent API updates (pi 0.51.0).</li>

<li>Agents: ensure OpenRouter attribution headers apply in the embedded runner.</li>

<li>Agents: cap context window resolution for compaction safeguard. (#6187) Thanks @iamEvanYT.</li>

<li>System prompt: resolve overrides and hint using session_status for current date/time. (#1897, #1928, #2108, #3677)</li>

<li>Agents: fix Pi prompt template argument syntax. (#6543)</li>

<li>Subagents: fix announce failover race (always emit lifecycle end; timeout=0 means no-timeout). (#6621)</li>

<li>Teams: gate media auth retries.</li>

<li>Telegram: restore draft streaming partials. (#5543) Thanks @obviyus.</li>

<li>Onboarding: friendlier Windows onboarding message. (#6242) Thanks @shanselman.</li>

<li>TUI: prevent crash when searching with digits in the model selector.</li>

<li>Agents: wire before_tool_call plugin hook into tool execution. (#6570, #6660) Thanks @ryancnelson.</li>

<li>Browser: secure Chrome extension relay CDP sessions.</li>

<li>Docker: use container port for gateway command instead of host port. (#5110) Thanks @mise42.</li>

<li>fix(lobster): block arbitrary exec via lobsterPath/cwd injection (GHSA-4mhr-g7xj-cg8j). (#5335) Thanks @vignesh07.</li>

<li>Security: sanitize WhatsApp accountId to prevent path traversal. (#4610)</li>

<li>Security: restrict MEDIA path extraction to prevent LFI. (#4930)</li>

<li>Security: validate message-tool filePath/path against sandbox root. (#6398)</li>

<li>Security: block LD*/DYLD* env overrides for host exec. (#4896) Thanks @HassanFleyah.</li>

<li>Security: harden web tool content wrapping + file parsing safeguards. (#4058) Thanks @VACInc.</li>

<li>Security: enforce Twitch <code>allowFrom</code> allowlist gating (deny non-allowlisted senders). Thanks @MegaManSec.</li>

</ul>

<p><a href="https://github.com/openclaw/openclaw/blob/main/CHANGELOG.md">View full changelog</a></p>

]]></description>

</item>

</channel>

</rss>

FilesExpand file tree

appcast.xml

Latest commit

History

appcast.xml

File metadata and controls